When peer delete failed in a disconnect operation, use-after-free
detected by KFENCE in below log. It is because for each vdev_id and
address, it has only one struct ath10k_peer, it is allocated in
ath10k_peer_map_event(). When connected to an AP, it has more than
one HTT_T2H_MSG_TYPE_PEER_MAP repo
Currently host can send two WMI commands at once.There is possibility to
cause SMMU issues or corruption, if host wants to initiate 2 DMA
transfers, it is possible when copy complete interrupt for first DMA
reaches host, CE has already updated SRRI (Source ring read index) for
both DMA transfers an
When peer delete failed in a disconnect operation, use-after-free
detected by KFENCE in below log. It is because for each vdev_id and
address, it has only one struct ath10k_peer, it is allocated in
ath10k_peer_map_event(). When connected to an AP, it has more than
one HTT_T2H_MSG_TYPE_PEER_MAP repo
allyesconfig
arc allyesconfig
x86_64randconfig-a002
x86_64randconfig-a011
i386 randconfig-a012-20220801
sh allmodconfig
powerpc allmodconfig
i386
kunit
mips allyesconfig
s390 randconfig-r044-20220731
x86_64 randconfig-a014-20220801
sh allmodconfig
i386 randconfig-a012-20220801
i386 randconfig-a013-20220801
i386 randconfig-a01
been built successfully.
More configs may be tested in the coming days.
gcc tested configs:
um i386_defconfig
um x86_64_defconfig
i386defconfig
arc randconfig-r043-20220801
s390